@test-lab-unsafe/safe-dep

WARNING: SECURITY RESEARCH / CTF LAB PACKAGE — DO NOT USE IN PRODUCTION

This package is part of a supply-chain attack demonstration lab.

What it looks like

A simple, innocent string utility library with 3 helper functions:

• capitalize(str) — Capitalizes first letter
• truncate(str, maxLength) — Truncates with ellipsis
• toKebabCase(str) — Converts to kebab-case

The source code looks completely clean. No suspicious scripts. No obvious red flags.

The hidden danger

This package depends on @test-lab-unsafe/evil-dep as a runtime dependency. When you run npm install @test-lab-unsafe/safe-dep, npm also installs evil-dep — and its postinstall script fires automatically, exfiltrating fake credentials to example.com before you can do anything about it.

Usage (demo only)

const { capitalize, truncate, toKebabCase } = require('@test-lab-unsafe/safe-dep');

console.log(capitalize('hello world'));     // Hello world
console.log(truncate('a very long...', 10)); // a very lo...
console.log(toKebabCase('myVariableName')); // my-variable-name

This package is for authorized security research and CTF/demo use only.